Security is a critical issue with almost all aspects of computer use and mobile electronic device use including such devices as computers, mobile phones, handheld computers, etc.
All modern operating systems provide a mechanism for security that involves some form of authentication or authorization, hereinafter generically referred to as authentication, to determine if a rightful user is accessing the system. For example, such a mechanism is the prompt for a user name and password by an operating system in a personal computer when it is powered up. Another example of such a mechanism is the prompt for authentication information when a user accesses a protected resource such as a secure file in a database. Implementing such security measures often requires modification of the user's behavior which, at the very least, involves the user having to enter authentication information one or more times while accessing the protected resource.
Requiring users to modify their behavior in order to obtain data security is a particularly arduous task, especially in the context of mobile devices. Most users are not used to securing their mobile devices with power-on user name and password, authentication information, etc. However, this is important to prevent unauthorized users from being able to incur large phone charges against the rightful user's cell phone account or accessing information that maybe deemed to be of a sensitive nature.
In the past, there have been several methods to reduce the complexity of the task of authorization, such as the use of picture passwords, key-based locking systems, transponder-based authentication, etc.
However, all such methods, while reducing the complexity of entering authorization information, still required such information to be provided and hence required a change in the usage behavior of a user who was used to using the cell phone without having to use security precautions before.
Also in the past, software security systems were used with subscriber identity modules (SIMs) or cards that enabled remote device management using protocols such as Open Mobile Alliance's SyncML (Device Management) protocol, etc. Such management software may be used to provide mobile devices with appropriate security features. Using such software, a security policy could be defined which did not prompt for any authentication or authorization unless a device had been marked as a security threat (in an event such as the device being lost or stolen, the SIM being changed, etc.)
However, if the device connectivity environment changed (in events such as changing the SIM, roaming to a different mobile network, etc), the device would not be able to communicate with the management software backend (server) and hence it would not be possible to remotely lock or wipe data off of the device.
Also, if the device is reset to default factory settings by formatting it, all connectivity is lost with the management software backend, and thus the device can thereafter be easily used without security protection. Thus, the best way currently known to ensure that the device is secure is to use some form of authentication or authorization while the device is running to ensure that the device is in the hands of the right user. Such a method, however, requires changes in the usage pattern for users not accustomed to taking security precautions.
Solutions to these problems have been long sought but prior developments have not taught or suggested any solutions and, thus, solutions to these problems have long eluded those skilled in the art.